Week 6: Data Anonymisation
Data tracking across websites
Cookies [and similar technologies] are ever present in the modern web.
They allow websites to track both the websites that we visit and how we engage with websites.
… but what about all those cookie popups?!
Source: Kretschmer et al 20211
Wired: Madhumita Venkataramanan: My identity for sale
I strongly recommend reading all of this article - wired.co.uk/article/my-identity-for-sale9.
The article is from 2014, but as we’ve discussed the GDPR cookie policy has if anything made this situation worse.
The article also provides a wealth of other examples of data tracking beyond cookies. These would be good examples for your assignment.
The quote below is from the article and summarises descriptions of Madhumita’s life tracked without consent.
I’m a 26-year-old British Asian woman, working in media and living in an SW postcode in London. I’ve previously lived at two addresses in Sussex and two others in north-east London. While I was growing up, my family lived in a detached house, took holidays to India every year, donated to medical charities, did most of the weekly shopping online at Ocado and read the Financial Times. Now, I rent a recently converted flat owned by a private landlord and have a housemate. I’m interested in movies and startups, have taken five holidays (mostly to visit friends abroad) in the last 12 months and I’m going to buy flights within 14 days. My annual income is probably between £30,000 and £39,999. I don’t have a TV or like watching scheduled television…
Early evidence for de-anonymisation (I)
In the late 90s there was a rapid conceptualisation of how easy it is to de-anonymisation large, public datasets.
Source: Latanya Sweeney in 1997Early evidence for de-anonymisation (II)
In the late 90s there was a rapid conceptualisation of how easy de-anonymisation is of large, public datasets.
Source: Latanya Sweeney in 2000k-anonymity: A Model for Protecting Privacy
Two years later in 20021 a statistical technique called k-anonymity was introduced to measure the risk of re-identification.
… by Latanya Sweeney16!
Originally her research into de-anonymisation was poorly received.
[1] Technically, the 2002 paper expands on the initial concept introduced in 1998 by Samarati and Sweeney18
k-anonymity: A definition (IX)
The definition I’ve given you is sufficient and precise.
But be aware that you’ll often16 see a more technical definition that uses set theory notation.
Ignore it. If a dataset is described as having “k-anonymity 10” that means for any row in the dataset there are at least 9 other rows identical to it.
Source: Formal definition for k-anonymity from Sweeney 200216
How to attack k-anonymised datasets (III)
There are 3 known attacks for attempt to de-anonymise datasets with k-anonymity:
Unsorted matching attack
Subsequent release attacks
Background knowledge
This is the most common attack vector and the Achilles’ heel of k-anonymity.
In these attacks background knowledge of relationships between quanti-identifiers is used to reduce anonymity.
High dimensionality means lots of quasi-identifiers.
… so where do we go next?
Source: Narayanan and Shmatikov 200820
l-diversity (I)
l-diversity is a more sophisticated measure of the anonymity of sensitive variables in an anonymised dataset - introduced by Machanavajjhala et al in 200621
This method depends on a Bayesian model of background knowledge.
We are not going to cover Bayesian statistics. Read statswithr.github.io/book/ if you’re interested.
Summarising k-anonymity and l-diversity
k-anonymity has well known vulnerabilities for high-dimensional datasets.
However. It is still worthwhile establishing at least 5-anonymity20 in released datasets containing sensitive attributes.
l-diversity is a much more sophisticated tool that provides stronger privacy protections. It’s verifiable NP-hard to re-identify individuals in l-diverse datasets.
However, l-diversity does not guarantee against re-identification. The coarsening of data might also degrade the usability of released data.
Source: Narayanan and Shmatikov 2008[]
Even though a minimum k value of 3 is often suggested, a common recommendation in practice is to ensure that there are at least five similar observations (k = 5)19
Netflix Prize Dataset: Re-identification (II)
The de-anonymisation attack is powered by two data sources:
- IMDB Ratings
- Date of movie review
The authors have written an extremely useful FAQ26.
Date of movie rating provides an additional attack vector.
Background knowledge might include account creation date, providing an attack vector for that user.
Case Study: In-store screens
Do you know what these machines are for in Tesco?
Case Study: In-store screens
These devices have embedded cameras that can track customer gaze - a proxy for the their attention.
The video feed from these devices is processed by software by Quividi that can estimate31:
Gender
Age
Mood
Their privacy page makes for interesting reading.
“Quividi’s software employs advanced facial detection software, not facial recognition technologies.” Quividi marketing
Anonymisation software? (I)
In 2021 Zuo et al32 performed a systematic review of de-anonymisation tools in digital health care.
There were two off-the-shelf tools identified that were built with R
-
- This package contains many tools for measuring/exploring the anonymity of datasets via a {shiny} app.
-
- This package provides a {shiny} app for anonymising healthcare data
Simulating fake datasets
We’ve used the {wakefield} package to create fake datasets.
The {faux} package is a more sophisticated package for simulating datasets designed by Lise DeBruine.
Useful resources (I)
This is an excellent module on privacy from Carnegie Mellon University.
You can find all lecture materials and even exercises here: https://course.ece.cmu.edu/~ece734/fall2019/syllabus.html
This quickly becomes very technical.
Useful resources (I)
Ashwin Machanavajjhala has an excellent course about privacy in a mobile world - https://courses.cs.duke.edu/fall13/compsci590.3/
This quickly becomes very technical.